US8543606B2 - Method and system for automated security access policy for a document management system - Google Patents

Method and system for automated security access policy for a document management system Download PDF

Info

Publication number
US8543606B2
US8543606B2 US13/709,695 US201213709695A US8543606B2 US 8543606 B2 US8543606 B2 US 8543606B2 US 201213709695 A US201213709695 A US 201213709695A US 8543606 B2 US8543606 B2 US 8543606B2
Authority
US
United States
Prior art keywords
document
metadata
system
processor
computer readable
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
US13/709,695
Other versions
US20130097667A1 (en
Inventor
Charles Edouard Pulfer
Benjamin Taylor WHITNEY
Regi Baby Roy
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
TITUS Inc
Original Assignee
TITUS Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority to US16768309P priority Critical
Priority to US12/749,291 priority patent/US8332350B2/en
Application filed by TITUS Inc filed Critical TITUS Inc
Assigned to TITUS LABS INC. reassignment TITUS LABS INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: PULFER, CHARLES EDOUARD, ROY, REGI BABY, WHITNEY, BENJAMIN TAYLOR
Priority to US13/709,695 priority patent/US8543606B2/en
Assigned to TITUS LABS INC. reassignment TITUS LABS INC. CHANGE OF ADDRESS OF COMPANY Assignors: TITUS LABS INC.
Assigned to TITUS INC. reassignment TITUS INC. CHANGE OF NAME (SEE DOCUMENT FOR DETAILS). Assignors: TITUS LABS INC.
Publication of US20130097667A1 publication Critical patent/US20130097667A1/en
Publication of US8543606B2 publication Critical patent/US8543606B2/en
Application granted granted Critical
Application status is Active legal-status Critical
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60Protecting data
    • G06F21/62Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90Details of database functions independent of the retrieved data types
    • G06F16/93Document management systems
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60Protecting data
    • G06F21/62Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6209Protecting access to data via a platform, e.g. using keys or access control rules to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself

Abstract

A method and system for providing an automated security access policy in a document management system are described. The security policies are applied based on metadata rules. Once a document is added to the document managements system, the metadata rules are evaluated using the metadata of the document. Based on the results of the evaluation security access policies are applied to the document.

Description

CROSS REFERENCE TO RELATED APPLICATIONS

The present application is a continuation application of U.S. patent application Ser. No. 12/749,291 filed on Mar. 29, 2010 (to be issued on Dec. 11, 2012 under U.S. Pat. No. 8,332,350) and claims benefit from the U.S. provisional application Ser. No. 61/167,683 for “Automated Security Access Policy for a Document Management System” filed on Apr. 8, 2009, the entire contents of which are incorporated herein by reference.

FIELD OF INVENTION

The invention generally relates to document management systems, and in particular, to a system and method providing an automated security access policy in a document management system.

BACKGROUND OF THE INVENTION

Maintenance of security of electronic documents such as files is an important aspect of any multiuser system. Various users may have various access rights for a given document. For example, some users may be denied access to it, some may be allowed to only read it, some may be allowed to read as well as modify it whereas some others may be able to only execute it. Both the maintenance of the access rights of the various uses for the different documents stored on the system as well as controlling document access in accordance with these stored access rights are crucial for a successful system operation.

Document management systems, or file management systems, also to be referred to as file server security systems, e.g., SharePoint, have an established paradigm of applying security policies providing access to files. Each document and folder has an “Access Control List” (ACL), which specifies users and groups who have access to the document and folder, and security access rights they have to the document and folder. Documents in folders inherit permissions of the folder and may override the privileges of an individual document, if necessary. This paradigm works well for some situations; however it only provides a hierarchal approach to applying security access policies to documents and folders in a document management system. This approach becomes less effective when administrators need to apply different security policies to each document, which makes defining the security access policies very time consuming.

Therefore there is a need in the industry for developing an improved process for providing security access policy in a document management system.

SUMMARY OF THE INVENTION

There is an object of the invention to provide an improved method and system for automatically providing security access policy in a document management system, which would avoid or mitigate the disadvantages of the prior art.

According to one aspect of the invention, there is provided a computerized method for automatically providing a security access policy to an electronic document in a document management system, the method comprising:

  • (a1) associating metadata with the document, the metadata comprising one or more attributes of the document;
  • (b1) configuring security access policies to be applied to documents in the document management system, including specifying one or more metadata rules governing application of security access policies to the documents; and
  • (c1) determining the security access policy to be applied to the document to be added to the document management system based on said one or more metadata rules and the metadata associated with the document.

The step (b1) of the method comprises:

  • (a2) creating said one or more metadata rules, comprising configuring a permission configuration web page;
  • (b2) storing said one or more metadata rules in a permissions setting configuration file; and
  • (c2) communicating the permissions setting configuration file to the document management system.

The step (a1) of the method comprises providing the attribute comprising a first field containing a name of the attribute and a second field containing a value of the attribute.

In the embodiments of the invention, the step (b1) comprises specifying said one or more metadata rules comprising a target name, a target value, a comparison operation for comparing the target value with the second field of the attribute the first field of which matches the target name, and the security access policy, comprising a permission set to be applied to the document for controlling access to the document based on results of the comparison operation.

Conveniently, the name of the attribute is selected from the group consisting of file size, file name, file type, date modified, word count, and author.

In the method described above, the step (c1) comprises:

  • (a6) receiving a notification from the document management system regarding adding the document to the document management system;
  • (b6) evaluating each metadata rule by performing the comparison operation in said each metadata rule; and
  • (c6) for said each metadata rule, applying the permission set to the document.

In the embodiments of the invention, the step (c6) comprises changing an access control list in the document management system, the access control list including names of users having access to the document along with corresponding levels of access of the users.

In the method described above, the specifying said one or more metadata rules comprises specifying a compound expression for performing multiple comparisons on the target name and the target value.

In the method described above, the specifying comprises specifying metadata including one or more of a contextual metadata that is inferred from contents of the document, an applied metadata that is attached to the document by an external program, and a dynamic metadata that is dynamically retrieved based on content analysis performed outside the document management system

Conveniently, the step (b2) comprises storing the permissions setting configuration file in an Extensible Markup Language (XML) format.

According to another aspect of the invention, there is provided a computer readable storage medium, having a computer readable program code instructions stored thereon, which, when executed by a computer, perform the following steps:

  • (a10) associating metadata with a document, the metadata comprising one or more attributes of the document;
  • (b10) configuring security access policies to be applied to documents in a document management system, including specifying one or more metadata rules governing application of security access policies to the documents; and
  • (c10) determining a security access policy to be applied to the document to be added to the document management system based on said one or more metadata rules and the metadata associated with the document.

According to yet another aspect of the invention, there is provided a system for automatically providing a security access policy to an electronic document in a document management system, the system comprising:

  • a processor, and a computer readable storage medium having computer readable instructions stored thereon, which, when executed by the processor, form the following:
  • (a11) a metadata storage module, storing metadata associated with the document, the metadata comprising one or more attributes of the document;
  • (b11) a security policy configuration module, configuring security access policies to be applied to documents in the document management system, including specifying one or more metadata rules governing application of security access policies to the documents; and
  • (c11) a security policy determination module, determining the security access policy to be applied to the document to be added to the document management system based on said one or more metadata rules and the metadata associated with the document.

The security policy configuration module (b11) comprises:

  • (a12) a policy handler module, creating said one or more metadata rules, comprising configuring a permission configuration web page;
  • (b12) a permissions setting configuration file, storing said one or more metadata rules; and
  • (c12) a policy configuration control module, communicating the permissions setting configuration file to the document management system.

The attribute of the document comprises a first field containing a name of the attribute and a second field containing a value of the attribute.

In the system described above, said one or more metadata rules comprise a target name, a target value, a comparison operation for comparing the target value with the second field of the attribute the first field of which matches the target name, and the security access policy, comprising a permission set to be applied to the document for controlling access to the document based on results of the comparison operation

Conveniently, the name of the attribute is selected from the group consisting of: file size, file name, file type, date modified, word count, and author.

In the system described above, the security policy determination module (c11) comprises:

  • (a16) a dispatcher module, receiving a notification from the document management system regarding adding the document to the document management system;
  • (b16) a metadata rule evaluator module, evaluating each metadata rule by performing the comparison operation in said each metadata rule; and
  • (c16) a permission processor module, applying, for each said metadata rule, the permission set to the document.

The permission processor module (c16) comprises computational means for changing an access control list in the document management system, the access control list including names of users having access to the document along with respective levels of access of the users.

In the embodiments of the invention, said one or more metadata rules comprises a compound expression for performing multiple comparisons on the target name and the target value.

Conveniently, the document management system is a Microsoft Share Point document library.

Thus, an improved method and system for automatically providing security access policy in a document management system have been described.

BRIEF DESCRIPTION OF THE DRAWINGS

Further features and advantages of the invention will be apparent from the following description of the embodiment, which is described by way of example only and with reference to the accompanying drawings, in which:

FIG. 1( a) presents a table illustrating an example list of attributes for a document;

FIG. 1( b) shows a sample implementation of a metadata rule configuration interface of the embodiment of the invention;

FIG. 2 shows a system 30 for a providing an automated security access policy to an electronic document in a document management system and illustrates its connection to the document management system.

FIG. 3 shows a flowchart 300 illustrating a method for providing an automated security access policy to the document;

FIG. 4 illustrates the step 304 “Configure security access policies” of FIG. 3 in more detail;

FIG. 5 illustrates the flow of operations for configuring a security access policy;

FIG. 6 illustrates the step 306 “Determine security access policy” of FIG. 3 in more detail; and

FIG. 7 illustrates the flow of operations when a document is added to a document management system.

DETAILED DESCRIPTION OF THE EMBODIMENTS OF THE INVENTION

Glossary

  • Access control list includes names of users having access to the document along with respective levels of access of the users
  • Compound expression characterizes multiple comparison operations on the target name and the target value
  • First field contains name of the attribute
  • Metadata comprises one or more attributes of the document
  • Metadata rules rules governing application of security access policies
  • Second field contains value of the attribute
  • XML Extensible Markup Language

Embodiments of the present invention describe methods and system for providing security access policies to documents. These documents often include files. Thus, the terms file and document are used interchangeably in this application. Embodiments of the present invention provide a classification-based method and system providing security access policy in a document management system. The invention allows documents to be granted security access based on their specified classification, category, physical attributes or tags. In particular, the embodiments of the invention provide an automated security access policy for a document management system, such as the Microsoft® Windows SharePoint Services platform. Security access policies of the documents in a library are derived based on attributes of the documents, known as metadata. The embodiments of the invention can however be adapted to other document management systems as well.

The method providing security access policy is guided by a set of metadata rules. The metadata rules provided by a system administrator are stored and are processed along with the metadata (attributes) associated with documents. Each metadata rule can be evaluated to be either true or false, and comprises four parts:

  • i) Target name: A target name can range from physical attributes of a document (e.g. the date modified, file size, file name), to customizable labeling of the document (such as Classification Level, Title, Customer Number).
  • ii) Comparison operation: The comparison operators are mathematical and text comparison operators which return a true or false value. For example: greater than, less than, equals, does not equal, and contains.
  • iii) Target value: The target value to compare to is dependent on the type of comparison being performed, and includes a numerical value such as a number, date, currency, a text value such as, “Classified”. The target values may not be required at all for some operations such as “property exists”.
  • iv) Security access policy: This comprises a permission set to be applied to the document. Based on the results of evaluation of a metadata rule, a series of permission actions can be performed on the Access Control List of the item in a SharePoint document management system for example, allowing users and user groups to be granted and revoked access.

Two or more comparison operations can be combined to form a larger (complex) compound expression with the use of optional joining operators, such as “AND” and “OR”.

For example: [Title] contains “secret” AND [Releasable]=“False”

With the four parts of the metadata rule, the evaluation of the metadata rule is performed in the following way. As described earlier, metadata comprises attributes of a document. Each attribute of the document comprises a first field that contains the name of the attribute and a second field that contains the value of the attribute. For example the first field of an attribute can be file size with the second filed as 1 Mbytes. When a metadata rule is evaluated its target name is matched with the first field of the attributes of the document. The following formula is then used on the matched attribute:

  • IF second Field of the matched attribute compares to target value, then apply security access policy.

Please note that the type of the “compares” operation is specified through the comparison operator in the metadata rule. Compound expressions using the joining operators AND and OR allow for complex comparison operations. For example,

  • If second field of matched attribute1 compares to target value 1 AND second field of matched attribute 2 compares to target value 2, then apply security access policy.

Note that the matching of an attribute i comprises the matching of the first field of the attribute with the target name i specified in the metadata rule.

An alternative form of metadata rule allows the negative (else) condition to have an associated security access policy. For example:

  • IF second field of the matched attribute compares to target value, then apply security access policy 1, else apply security access policy 2.

The permission set associated with the If part is also referred to as the “True permissions” and that associated with the else part is also referred to as “false” permission”.

In the embodiments of the invention, the metadata rules comprise computer readable instructions stored in a computer readable storage medium, e.g., computer memory, DVD, CD-ROM, floppy or other medium, which, when executed by a processor, form the metadata rules including the four parts described, and perform the evaluation of the metadata as described earlier.

The approach to automatically providing security access policy in a document management system described earlier provides numerous advantages. For example, it provides a unique and flexible security access structure, with which, system administrators need only define the overall metadata rules that automatically provide the security access policy, allowing different documents to have security access policies based on their content and attributes. As a result, system administrators do not need to separately define security access policy for each document, making security access management of documents significantly easier.

Parts of the Metadata Rule

As mentioned earlier, a metadata rule contains a target name, a comparison operation, a target value, and a security policy. These four parts are explained in more detail.

Target Name

A target name is matched with the name of an attribute in the metadata. Metadata is information which describes other data. Computer files have a large quantity of metadata from multiple sources as it is processed by various computer programs and users.

Metadata is associated with each document and describes the content and context of its use. It comprises attributes of the document, which in the embodiments of the invention include: attribute name, attribute type, data type, and attribute value. For example, the metadata for a Microsoft Word document may comprise various attributes associated with the document. An example list of such attributes is presented in table 9 of FIG. 1( a). For Microsoft documents, an attribute can be one of the built in fields in SharePoint such as File Name, File Type, Title, Author, User Last Modified By, Content Type, or any of the custom columns added to the document library by the user.

The value of an attribute corresponding to a given attribute name is converted from its native data type, which includes text, user id and number, into a digital format for comparison purposes, and is stored as a corresponding “data type” as illustrated in column 3 of table 9 shown in FIG. 1( a). The data type corresponding to a value of the attribute can be numerical, text, date and time, true/false or binary data.

In the embodiment of the invention, the attribute type includes Contextual Metadata and Applied Metadata. Contextual Metadata is metadata that can be inferred through examination of the document and its contents. This can be interpreted with the help of computer software by looking at the physical attributes of the computer file or the object(s) which the file represents.

Examples of contextual metadata include the following: File Length, Creation Date, Last Modification Date, Photo Width and Height and Word Count;

Applied metadata is metadata that is attached to the document by an external program. Often a user assists in applying metadata, such as describing key words or entering a sentence describing the document. Applied metadata is often saved as a section within the document which can be examined by other computer programs.

Examples of Applied metadata include Description, Category, Key words, Classification Level and Customer ID. Dynamic Metadata that is handled in an alternate embodiment is dynamically retrieved based on external content analysis and cannot be inferred directly from the document contents. Dynamic metadata requires processing of the document by a metadata extractor that is either an internal system or an external unit invoked through a network connection.

Examples of Dynamic metadata are: external database queries, automated image analysis and content analysis using natural language processing all of which are Metadata fields corresponding to the Dynamic metadata type.

When a document is added to a document management system such as Microsoft SharePoint, metadata are extracted from the document and made available to system of the present invention through a storage unit storing the metadata. When dynamic metadata is requested, a Dynamic metadata extractor is used to perform metadata extraction.

Comparison Operators

A comparison operation is an important part of a metadata rule. The comparison operators return a true or false value. Conveniently, they are case-insensitive, meaning that upper case letters are considered equal to lower-case letters. Metadata value is read as digital value, irrespective of whether it is text, numbers, dates or other data types, and as such, comparisons can be evaluated based on the data. Examples of comparison operations are provided next:

    • If Document Title contains “Budget”, apply permission set “Financial Group”;
    • If Security Classification equals “Classified”, apply permission set “Classified Users”;
    • If Content Type equals “Marketing Slideshow”, apply permission set “Marketing”.

For example, using table 9 shown in FIG. 1( a), the comparison “[Word Count]>1000” would evaluate to false, since the attribute having a name Word Count has a value of 724.

On the other hand if “[Classification Level]=‘CLASSIFIED’ is evaluated, the result of the evaluation would be true, since that is the value of the attribute with name Classification Level.

Examples of comparison operators include:

    • i. Less Than (<)
    • ii. Less Than or Equal To (<=)
    • iii. Greater Than (>)
    • iv. Greater Than or Equal To (>=)
    • v. Equals (=)
    • vi. Does Not Equal (!=)
    • vii. Contains Value
    • viii. Does Not Contain Value
    • ix. Exists
    • x. Does Not Exist
    • xi. Starts With
    • xii. Ends With

Not all operators are applicable with all types of data. For example, asking if “apple>orange” doesn't make much sense. Other operators such as “contains value” and “does not contain value” are only valid for text values. Operators such as “exists” and “does not exist” ask only if the attribute with a given name was part of the metadata, regardless of value, and as such does not require a value to compare to.

Evaluation of Metadata Comparisons

The comparison operators that are supported in the embodiment s of the invention are discussed further. Each of these operators, when evaluated, would lead to a true or false result. For each operator, an explanation of the operator is provided followed by examples.

    • Equals—Value of matched attribute is equal to Target Value.
  • “ABC” equals “ABC” is true
  • “ABC” equals “DEF” is false
    • Does Not Equal—Value of matched attribute is not equal to Target Value.
  • “ABC” does not equal “DEF” is true
  • “ABC” does not equal “ABC” is false
    • Contains—Value of matched attribute contains the text of Target Value.
  • “AB” contains “A” is true
  • “AB” contains “B” is true
  • “AB” contains “AB” is true
  • “AB” contains “C” is false
    • Does Not Contain—Value of matched attribute does not contain the text of Target Value.
  • “AB” does not contain “C” is true
  • “AB” does not contain “A” is false
    • Starts With—Value of matched attribute starts with the text of Target Value.
  • “AB” starts with “A” is true
  • “AB” starts with “AB” is true
  • “AB” starts with “ABC” is false
  • “AB” starts with “C” is false
    • Does Not Start With—Value of matched attribute does not start with text of Target Value.
  • “AB” does not start with “B” is true
  • “AB” does not start with “ABC” is true
  • “AB” does not start with “A” is false
  • “AB” does not start with “AB” is false
    • Ends With—Value of matched attribute ends with text of Target Value.
  • “BC” ends with “C” is true
  • “BC” ends with “BC” is true
  • “BC” ends with “ABC” is false
  • “BC” ends with “D” is false
    • Does Not End With—Value of matched attribute does not end with text of Target Value.
  • “BC” does not end with “B” is true
  • “BC” does not end with “ABC” is true
  • “BC” does not end with “C” is false
  • “BC” does not end with “BC” is false
    Target Value

Target Value is a value specified by the system administrator. It is saved as a text-based value.

When comparing the value of an attribute to the Target Value, both values generally have to be of the same data type. For example, text is compared with text, dates are compared to dates and numbers are compared with numbers. In some cases, a target value is not required, such as in the case of the “exists” and “does not exist” comparison operators.

Security Access Policy

Security access policy comprises a permission set to apply if the rule is evaluated successfully. Documents stored in document management systems have security permissions applied to them, generally in the form of Access Control Lists. These lists contain names of people who have access to the document, and the level of access that they have. The ACL also includes user groups such as “Marketing Department”, each user in which receives the same level of access to that document.

When a metadata rule is evaluated, a security access policy can get applied to the document based on the results of the evaluation. The security access policy can lead to a set of operations that include for example:

  • Make the document hidden;
  • Move the document to another location;
    • Present a different view of the document;
    • Add to list of users/user groups who can see the document;
    • Add to list of users/user groups who can edit the document;
    • Add to list of users/user groups who can delete the document;
    • Remove specific users/user groups from list of users who can see the document;
    • Remove specific users/user groups from list of users who can edit the document;
    • Remove specific users/user groups from list of users who can delete the document;
    • Publish the document to the public;

The types of security access policies that can be applied depend on the capabilities of the document management system. Some systems may only support basic operations and others may contain elaborate control structures.

The metadata rules include security access polices for the document management system. Thus, access to the facilities for configuring metadata rules should be limited to system administrators. FIG. 1( b) shows a diagram 10 illustrating a sample implementation of a metadata rule configuration interface of the embodiment of the invention. The metadata rule configuration window 14 is placed within another host window 12 that is provided by the document management system for example. The metadata rule configuration window 14 provides various buttons for specifying the metadata rules.

The system of the embodiment of the invention is described next. The system 30 of the embodiment of the invention shown in FIG. 2 includes a general purpose or specialized computer having a CPU and a computer readable medium, e.g., memory, DVD, CD-ROM, floppy disk, flash memory, magnetic tape or other storage medium, having computer readable instructions stored thereon for execution by the CPU, which form various modules of the system as will be described in detail below. Alternatively, the system can be implemented in firmware, or combination of firmware and a specialized computer having a computer readable storage medium.

The structure of a system 10 for providing automated security access policy to a document in a document management system according to the embodiment of the invention is displayed in FIG. 2. A Microsoft SharePoint system is used as an example document management system. System 30 shows a SharePoint Document Library 1 connected with two modules of the embodiment of the invention: a Security Policy Configuration Module 2 and a Security Policy Determination Module 3. The document library is the container of the files. It resembles a network share on a computer, including files and folders, where certain people who are granted permission to access it. The SharePoint Document Library 1 communicates with the Security Policy Configuration Module 2 by using Connect 4.1 and with the Security Policy Determination Module 3 by using connect 4.2. The Security Policy Configuration Module 2 interacts with the Security Policy Determination Module by using Connect 4.3. The SharePoint Document Library 1 is described first followed by the Security Policy Configuration Module 2 and the Security Policy Determination Module 3.

SharePoint Document Library 1

The SharePoint Document Library 1 is a specialized type of SharePoint List for the storage of documents and allows for events to be processed when documents are added, updated, and removed from the document library. The processing of these events allows the security access policies to be applied to documents in the SharePoint Library 1.

The SharePoint Document Library 1 comprises a SharePoint Information Management Policy Configuration Module 1.0 a Document Store Module 1.4, a Permissions Module 1.5, and an Event Receivers Module 1.6. The SharePoint Information Management Policy Configuration Module 1.0 in turn includes a Document Type Definition Module 1.1, a Policies Module 1.2 and a Policy Configuration Store Module 1.3. Each of these modules is briefly described.

Document Content Type Definition Module 1.1

This module is the base document Content Type of the SharePoint Document Library (1). Content type is a definition of the metadata properties for a certain type of document. A file in a document library has a content-type, and that content-type defines the fields of metadata associated with it. Details can be found at http://msdn.microsoft.com/en-us/library/ms472236.aspx. Content types also store behavior settings associated with that type of file. It becomes the container for documents as they are stored in the Document Store (1.4).

Policies Module 1.2

This module contains a set of information management policies that can be applied to documents in this library. Information management policies enforce rules on how content is accessed and managed, generally in the context of compliance, for example Sarbanes-Oxley, etc. Information management policies are executed on items. Security access policies rely on a rights based Access Control List which determines whether or not a requested security action, for example, read file, is permitted by the logged-in user. The Policy Handler Module 2.2 is connected, through the Connect 4.1, to the Policies Module 1.2.

Policy Configuration Store Module 1.3

This module is a section of the SharePoint database used for the storage of permission settings corresponding to the policies configured by a system administrator. When a security access policy is configured by using the Policy Configuration Control Module 2.1, the data is sent through Connect 4.1 and saved in an XML format in the Policy Configuration Store Module 1.3.

Document Store Module 1.4

This module is a section of the SharePoint database where the actual documents and metadata associated with the document are stored and then associated with the Share-Point Document Library 1. The Document Store Module 1.4 exposes metadata read by the Metadata Rule Evaluator 3.2. Additions or modifications to the Document Store Module 1.4 require the Event Receivers Module 1.6 to notify their listeners.

Permissions Module 1.5

This module defines the permission set for each document in the document library. There are base permissions inherited by the SharePoint Document Library (1), as well as refined permissions on each document available in the Document Store Module 1.4. The Permission Processor Module 3.4 sets the permissions when metadata rules are evaluated.

Event Receivers Module 1.6

This module contains event receivers that allow the SharePoint Document Library 1 to communicate with the Dispatcher Module 3.1 through Connect 4.2. The events relevant to the current invention include two events in the SharePoint Document Library 1: the ItemAdded event, which occurs when a document is added, and the ItemUpdated event, which occurs when a document or the metadata associated with the document changes.

Metadata Storage Module 1.7

This module stores the metadata associated with documents. The Metadata Storage Module 1.7 comprises computer readable data stored in a computer readable storage medium e.g., memory, DVD, CD-ROM, floppy disk, flash memory and magnetic tape. Although the Metadata Storage Module 1.7 is shown as a part of the Document Store Module 1.4, it can be located outside the SharePoint Document Library 1 as well.

The Security Policy Configuration Module 2 that allows the configuration of the security access policies by the system administrator comprises a Policy Configuration Control Module 2.1, a Policy Handler Module 2.2, a Permissions Configuration Webpage 2.3 and a Permissions Settings Configuration file 2.4. Each of these is briefly described.

Policy Configuration Control Module 2.1

This module is a user interface, which allows the configuration of the information management policy available in the Policies Module 1.2. The Policy Configuration Control Module 2.1 has settings allowing the user to create metadata rules, and specify the associated permission sets, which are loaded from the Permission Settings Configuration File 2.4. These permission sets are to be applied based on the results of the evaluation of the metadata rules. This Policy Configuration Control Module 2.1 includes a hyperlink to the Permission Configuration Web page 2.3 that allows the permission sets to be defined.

Policy Handler Module 2.2

This module is a required interface to install an information management policy in the Policies Module 1.2. It handles events for Register and UnRegister sent to the Document Type Definition Module 1.1 in the SharePoint Document Library 1. It also registers the Policy Configuration Control Module 2.1 and allows it to be used.

Permission Configuration Web Page 2.3

This web page allows permission sets to be configured or defined by the system administrator. The permission set is associated with a group of SharePoint users and groups and their associated permission level. The metadata rules that include the permission sets are saved in the Permission Settings Configuration File 2.4.

Permission Settings Configuration File 2.4

This file is an XML based configuration file which stores the metadata rules including the permission sets defined using the Permission Configuration Web Page 2.3.

The Security Policy Determination Module 3 comprises a Dispatcher Module 3.1, a Metadata Rule Evaluator Module 3.2, a Dynamic Metadata Extractor Module 3.3 and a Permission Processor Module 3.4. Each of these modules is briefly described.

Dispatcher Module 3.1

This module implements the interface to Event Receivers Module 1.6 for receiving the ItemAdded and ItemUpdated events. The Dispatcher Module 3.1 then determines if processing should be performed, and if so, passes control to the Metadata Rule Evaluator Module 3.2.

Metadata Rule Evaluator Module 3.2

This module is triggered by the Dispatcher Module 3.1 to process the ItemAdded and ItemUpdated events. Once invoked, the Metadata Rule Evaluator Module 3.2 loads the saved metadata settings from the Policy Configuration Store Module 1.3, retrieves the item metadata from the Document Store Module 1.4, and extracts dynamic metadata by using the Dynamic Metadata Extractor Module 3.3. Then it evaluates the metadata rule and triggers the Permission Processor Module 3.4 to modify the permissions associated with the document.

Dynamic Metadata Extractor Module 3.3

This module that is included in alternate embodiment receives the request from the Metadata Rule Evaluator Module 3.2, and determines the metadata requirements for this metadata rule. The Dynamic Metadata Extractor Module 3.3 performs the requested dynamic analysis of the document and returns the results in the form of text metadata to the Metadata Rule Evaluator Module 3.2.

Permission Processor Module 3.4

This module loads the Permission Settings Configuration File 2.4 using Connect 4.3, receives the name of the document to process from the Metadata Rule Evaluator Module 3.2, and applies the changes to the permissions associated with the document by using the Permissions Module 1.5 in the SharePoint Document Library 1. In another embodiment of the invention the Permission Processor Module 3.4 comprises computational means 3.5 for changing the ACL in the document management system.

As noted earlier, the Dynamic Metadata Extractor Module 3.3 is included in an alternate embodiment. In yet another alternate embodiment the Dynamic Metadata Extractor Module 3.3 is external to the Security Policy Determination Module 3 and is invoked via a network connection.

The modules of the system that include modules 2, 2.1, 2.2, 2.3, 2.4, 3, 3.1, 3.2, 3.3 and 3.4 include a firmware or, alternatively, computer readable instructions stored in a computer readable storage medium for execution by a processor. The computational means 3.5 comprises computer readable code performing methods, procedures, functions or subroutines which are stored in a computer readable storage medium to be executed by a CPU.

Additional embodiments of the invention include only a subset of the all the modules described earlier. The minimum functionality to be provided includes: (i) Metadata Rule Configuration (ii) Metadata Security Access Policy Data Store (iii) Attachment to the Document Management System and (iv) Metadata Rule Processing. The minimal set of modules that can achieve this functionality are presented next.

  • (i) Permission Configuration Webpage 2.3: assists the system administrator with metadata rule configuration and helps in defining the metadata rules and the security access policies which should be applied. This can take the form of a computer program or a web server component.
  • (ii) Permission Setting Configuration File 2.4: stores the metadata rules after they are configured. Depending on the environment, the metadata rules may also be saved internally as a setting in the product configuration instead of in the Permissions Setting Configuration file 2.4.
  • (iii) Connect 4.1 and 4.2: serve as attachments to the document management system. In order to be able to apply security access policies to the documents, a hook into the document management system is required for receiving events. Document management systems such as SharePoint allow external programs to receive “events” from the document library, such as when a new document is added or is modified by a user. Connect 4.1 and 4.2 are used to pass on the type of the event and additional data associated with the event to the embodiments of the invention for further processing.
  • (iv) Metadata Rule Evaluator Module 3.2: process the metadata rules. When the event corresponding to the adding of a document in the document management system for example, is received by the embodiment of the invention, each metadata rule is evaluated. When a metadata rule is evaluated the security access policy associated with the rule is applied to the document based on the results of the evaluation.

FIG. 3 shows a flowchart 300 illustrating a method for automatically providing a security access policy to a document management system according to the embodiments of the invention. Upon start (box 302), the procedure 300 configures the security access policies based on the input provided by the system administrator (box 304). In the next step the procedure 300 determines the security access policy to be applied to the document that is added to the document management system by the user (box 306) and exits (box 308).

FIG. 4 presents flowchart 400 illustrating the step 304 “Configure security access policies” of FIG. 3 in more detail. Upon start (box 402), the procedure 400 installs the Permission Configuration Web Page 2.3 (box 404) for facilitating the creation of metadata rules. As the system administrator configures this web page and cerates the metadata rules, the inputs from the system administrator are received by the procedure 400 (box 406). Once the system administrator completes the creation of metadata rules and invokes a “save” operation, the procedure 400 saves the metadata rules in the Permissions Setting Configuration File 2.4 (box 408), communicates the metadata rules contained in the Permissions Setting Configuration File 2.4 to the document management system (box 410), and exits (box 412).

The operation of the Security Policy Configuration Module 2 is explained further with the sequence diagram 500 presented in FIG. 5 that captures the sequence of operations performed when the procedure 400 is executed.

Flow of Operations—Configuring a Policy

The following operations occur when the system administrator 6 first activates and configures the metadata security policy for a document management system.

    • Step 1 (502). System administrator 6 invokes 516 the configuration page of the SharePoint Document Library 1.
    • Step 2 (504). System administrator 6 activates the security access policy, which causes the Register event 518 on the Policy Handler Module 2.2.
    • Step 3 (506). In response to the Register event 518, Policy Handler Module 2.2 installs 520 the security access policy into the Policies Module 1.2 of the SharePoint Document Library 1. This allows the Configuration Web Page 2.3 to be installed and loaded. The Configuration Web Page 2.3 allows the system administrator 6 to create new metadata rules.
    • Step 4 (508). System administrator 6 defines metadata rules and visits the Permission Configuration Web page 2.3 to define the permissions sets which are stored in the Permission Settings Configuration File 2.4.
    • Step 5 (510). System administrator 6 clicks to save the changes that initiate a message 522 to the Policy Configuration Module 2.1.
    • Step 6 (512). The Policy Configuration Control 2.1 creates an XML stream 524 representing the current configuration settings that is communicated to the SharePoint Document Library 1.
    • Step 7 (514). This data is saved in the Policy Configuration Store 1.3 in the Share-Point Document Library 1, so that the metadata rules can be retrieved as needed.

FIG. 6 presents flowchart 600 illustrating the step 306 “Determine security access policy” of FIG. 3 in more detail. Upon start (box 602), the procedure 600 receives the document added by the user to the document management system (box 604) and checks whether metadata security is enabled (box 606). If not, the procedure 600 exits ‘NO’ from box 606 and exits (box 622). Otherwise, the procedure 600 exits ‘YES’ from box 606, dispatches the metadata security policy (box 608) and evaluates the first metadata rule (box 610). Whether the result of the operation specified in the metadata rule is true is evaluated. If so, the security access policy corresponding to the “If” clause of the metadata rule is followed and the “True” permission is applied (box 614). If the result of the operation is false, the procedure 600 exits ‘NO’ from box 612 and checks whether there is an “else” clause or a “False” permission associated with the metadata rule. If so, the procedure exits ‘YES’ from box 618, applies the “False” permission (box 620) and proceeds to the input of box 616. Otherwise, the procedure 600 exits ‘NO’ from box 618, skips box 620 and proceeds to check whether there are more metadata rules (box 616). If so, the procedure 600 proceeds to the input of box 610 to evaluate the next metadata rule. Otherwise, the procedure 600 exits (box 622). In an alternate embodiment the procedure 600 uses the Dynamic Metadata Extractor Module 3.3 for performing a dynamic analysis of the document the results of which are used in the evaluation of the metadata rules (box 610).

The operation of the Security Policy Determination Module 3 is explained further with the sequence diagram 700 presented in FIG. 7 that captures the sequence of operations performed when the procedure 600 is executed.

Flow of Operations—Document Added to Document Management System

The following operations occur once the metadata security access policy is installed on the management system and a document is added by the user.

    • Step 1 (702). User 5 uploads a new document of a specified Document Content Type to the SharePoint Document Library 1.
    • Step 2 (704). The document is added 720 to the Document Store 1.4 in the Share-Point Document Library 1 where its metadata is saved.
    • Step 3 (706). The document is initially assigned the default permissions of the SharePoint Document Library 1.
    • Step 4 (708). The Event Receivers Module 1.6 dispatches the ItemAdded event 722.
    • Step 5 (710). The Dispatcher Module 3.1 receives the ItemAdded event 722 and calls 724 the Metadata Rule Evaluator Module 3.2.
    • Step 6 (712). The Metadata Rule Evaluator Module 3.2 receives 725 the list of metadata rules in XML from the Policy Configuration Store 1.3. It requests 726 the document metadata from the Document Store Module 1.4. In an alternate embodiment it then requests 727 dynamic metadata from the Dynamic Metadata Extractor Module 3.3.
    • Step 7 (714). The Dynamic Metadata Extractor Module 3.3 receives the request 727 from the Metadata Rule Evaluator Module 3.2 and determines the metadata requirements for this metadata rule. The Dynamic Metadata Extractor Module 3.3 performs the requested dynamic analysis of the document and returns the results 728 in the form of text metadata to the Metadata Rule Evaluator Module 3.2.
    • Step 8 (716). The Metadata Rule Evaluator Module 3.2 evaluates the metadata rules using the metadata associated with the document and calls 730 the Permission Processor Module 3.4 to apply the permissions of the document.
    • Step 9 (718). The Permission Processor Module 3.4 loads the permission set from the Permission Settings Configuration File 2.4, and changes the document permissions to reflect the permissions in this permission set.

Although specific embodiments of the invention have been described in detail, it should be understood that the described embodiments are intended to be illustrative and not restrictive. Various changes and modifications of the embodiments shown in the drawings and described in the specification may be made within the scope of the following claims without departing from the scope of the invention in its broader aspect. For example, multiple document management systems can be handled by a single set of Security Policy Configuration Module 2 and Security Policy Determination Module 3. The embodiments of the invention can also be used in conjunction with a computer network to remotely apply security access policies to documents in a document management system that is located in another location.

Although the embodiments of the invention have been described in detail, it will be apparent to one skilled in the art that variations and modifications to the embodiments may be made within the scope of the following claims.

Claims (21)

What is claimed is:
1. A system for automatically creating a security access policy to an electronic document in a document management system, the system comprising:
a processor; and
a non-transitory computer readable storage medium, having computer readable instructions stored thereon for execution by the processor, causing the processor to:
associate metadata with the document, the metadata comprising one or more attributes of the document; the metadata comprising:
a contextual metadata, which is inferred from contents of the document;
an applied metadata, which is attached to the document by an external program; and
a dynamic metadata, which is dynamically retrieved based on external content analysis of the document performed outside of the document management system;
configure security access policies to be applied to documents in the document management system, comprising specifying one or more metadata rules operating on the metadata and governing application of security access policies to the documents; and
determine the security access policy to be applied to the document to be added to the document management system based on the one or more metadata rules and the metadata associated with the document.
2. The system of claim 1, wherein the computer readable instructions further cause the processor to:
create said one or more metadata rules;
store said one or more metadata rules in a permissions setting configuration file; and
communicate the permissions setting configuration file to the document management system.
3. The system of claim 2, wherein the computer readable instructions further cause the processor to configure a permission configuration web page for said one or more metadata rules.
4. The system of claim 2, wherein the computer readable instructions further cause the processor to store the permissions setting configuration file in an Extensible Markup Language (XML) format.
5. The system of claim 1, wherein the computer readable instructions further cause the processor to provide an attribute comprising a first field containing a name of the attribute and a second field containing a value of the attribute.
6. The system of claim 5, wherein the computer readable instructions further cause the processor to specify said one or more metadata rules comprising a target name, a target value, a comparison operation for comparing the target value with the second field of the attribute the first field of which matches the target name.
7. The system of claim 6, wherein the computer readable instructions further cause the processor to specify the security access policy, comprising a permission set to be applied to the document for controlling access to the document based on results of the comparison operation.
8. The system of claim 7, wherein the computer readable instructions further cause the processor to:
receive a notification from the document management system regarding adding the document to the document management system;
evaluate each metadata rule by performing the comparison operation in said each metadata rule; and
for said each metadata rule, apply the permission set to the document.
9. The system of claim 6, wherein the computer readable instructions further cause the processor to specify a compound expression for performing multiple comparisons on the target name and the target value.
10. The system of claim 5, wherein the computer readable instructions further cause the processor to provide the name of the attribute, which is a file size.
11. The system of claim 5, wherein the computer readable instructions further cause the processor to provide the name of the attribute, which is a file name.
12. The system of claim 5, wherein the computer readable instructions further cause the processor to provide the name of the attribute, which is a file type.
13. The system of claim 5, wherein the computer readable instructions further cause the processor to provide the name of the attribute, which is a date when a file size has been modified.
14. The system of claim 5, wherein the computer readable instructions further cause the processor to provide the name of the attribute, which is a word count for a file or a name of an author of the file.
15. The system of claim 5, wherein the computer readable instructions further cause the processor to provide the name of the attribute, which is selected from the group consisting from a classification level, title, and a customer number for the document.
16. The system of claim 1, wherein the computer readable instructions further cause the processor to change an access control list in the document management system, the access control list including names of users having access to the document along with corresponding levels of access of the users.
17. The system of claim 1, wherein the computer readable instructions further cause the processor to perform an automated content analysis of the document using natural language processing.
18. The system of claim 1, wherein the computer readable instructions further cause the processor to perform an automated content analysis of the document using external database queries.
19. The system of claim 1, wherein the document management system is a file management system.
20. The system of claim 1, wherein the document management system is a Microsoft Share Point document library.
21. A method for automatically creating a security access policy to an electronic document in a document management system, the method comprising:
using a processor for:
associating metadata with the document, the metadata comprising one or more attributes of the document; the metadata comprising:
a contextual metadata, which is inferred from contents of the document;
an applied metadata, which is attached to the document by an external program; and
a dynamic metadata, which is dynamically retrieved based on external content analysis of the document performed outside of the document management system;
configuring security access policies to be applied to documents in the document management system, comprising specifying one or more metadata rules operating on the metadata and governing application of security access policies to the documents; and
determining the security access policy to be applied to the document to be added to the document management system based on the one or more metadata rules and the metadata associated with the document.
US13/709,695 2009-04-08 2012-12-10 Method and system for automated security access policy for a document management system Active US8543606B2 (en)

Priority Applications (3)

Application Number Priority Date Filing Date Title
US16768309P true 2009-04-08 2009-04-08
US12/749,291 US8332350B2 (en) 2009-04-08 2010-03-29 Method and system for automated security access policy for a document management system
US13/709,695 US8543606B2 (en) 2009-04-08 2012-12-10 Method and system for automated security access policy for a document management system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
US13/709,695 US8543606B2 (en) 2009-04-08 2012-12-10 Method and system for automated security access policy for a document management system

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
US12/749,291 Continuation US8332350B2 (en) 2009-04-08 2010-03-29 Method and system for automated security access policy for a document management system

Publications (2)

Publication Number Publication Date
US20130097667A1 US20130097667A1 (en) 2013-04-18
US8543606B2 true US8543606B2 (en) 2013-09-24

Family

ID=42935156

Family Applications (2)

Application Number Title Priority Date Filing Date
US12/749,291 Active 2031-03-09 US8332350B2 (en) 2009-04-08 2010-03-29 Method and system for automated security access policy for a document management system
US13/709,695 Active US8543606B2 (en) 2009-04-08 2012-12-10 Method and system for automated security access policy for a document management system

Family Applications Before (1)

Application Number Title Priority Date Filing Date
US12/749,291 Active 2031-03-09 US8332350B2 (en) 2009-04-08 2010-03-29 Method and system for automated security access policy for a document management system

Country Status (1)

Country Link
US (2) US8332350B2 (en)

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130332213A1 (en) * 2012-06-07 2013-12-12 Jayne Heggen Virtual Outsourcing Agency System and Method
US8955040B2 (en) 2012-02-27 2015-02-10 Axiomatics Ab Provisioning authorization claims using attribute-based access-control policies
US9754098B2 (en) 2014-10-26 2017-09-05 Microsoft Technology Licensing, Llc Providing policy tips for data loss prevention in collaborative environments
US9973509B2 (en) 2014-09-05 2018-05-15 Axiomatics Ab Provisioning system-level permissions using attribute-based access control policies
US10007800B2 (en) 2015-02-19 2018-06-26 Axiomatics Ab Remote rule execution
US20180336033A1 (en) * 2015-12-17 2018-11-22 The Charles Stark Draper Laboratory, Inc. Metadata Processing
US10545760B2 (en) * 2018-06-07 2020-01-28 The Charles Stark Draper Laboratory, Inc. Metadata processing

Families Citing this family (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050062492A1 (en) * 2001-08-03 2005-03-24 Beaman Brian Samuel High density integrated circuit apparatus, test probe and methods of use thereof
US8627403B1 (en) * 2007-07-31 2014-01-07 Hewlett-Packard Development Company, L.P. Policy applicability determination
US9292702B2 (en) 2009-08-20 2016-03-22 International Business Machines Corporation Dynamic switching of security configurations
US8230478B2 (en) * 2009-08-27 2012-07-24 International Business Machines Corporation Flexibly assigning security configurations to applications
GB201000021D0 (en) * 2010-01-04 2010-02-17 Plastic Logic Ltd Electronic document reading devices
US20110247074A1 (en) * 2010-03-30 2011-10-06 Manring Bradley A C Metadata-based access, security, and compliance control of software generated files
US8552833B2 (en) 2010-06-10 2013-10-08 Ricoh Company, Ltd. Security system for managing information on mobile wireless devices
US9137014B2 (en) * 2011-01-25 2015-09-15 Adobe Systems Incorporated Systems and methods for controlling electronic document use
US9165289B2 (en) 2011-02-28 2015-10-20 Ricoh Company, Ltd. Electronic meeting management for mobile wireless devices with post meeting processing
US8732792B2 (en) 2012-06-20 2014-05-20 Ricoh Company, Ltd. Approach for managing access to data on client devices
US20130347054A1 (en) * 2012-06-20 2013-12-26 Tetsuro Motoyama Approach For Managing Access To Data On Client Devices
US9213805B2 (en) 2012-06-20 2015-12-15 Ricoh Company, Ltd. Approach for managing access to data on client devices
US9576141B2 (en) * 2013-01-22 2017-02-21 Amazon Technologies, Inc. Access controls on the use of freeform metadata
US10341281B2 (en) 2013-01-22 2019-07-02 Amazon Technologies, Inc. Access control policies associated with freeform metadata
US9310981B2 (en) * 2013-02-13 2016-04-12 Dropbox, Inc. Seamless editing and saving of online content items using applications
US20140310771A1 (en) * 2013-04-13 2014-10-16 Sky Sockett, LLC Time-based Functionality Restrictions
US9426162B2 (en) 2013-05-02 2016-08-23 Airwatch Llc Location-based configuration policy toggling
US9288283B2 (en) * 2013-12-04 2016-03-15 Dropbox, Inc. Systems and methods for managing shared content based on sharing profiles
WO2015123782A1 (en) * 2014-02-21 2015-08-27 Titus Inc. Reducing inadvertent data loss in email
US10270796B1 (en) * 2016-03-25 2019-04-23 EMC IP Holding Company LLC Data protection analytics in cloud computing platform

Citations (53)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20010010052A1 (en) 2000-01-25 2001-07-26 Satoshi Sakamoto Method for controlling multithreading
US20030105734A1 (en) 2001-11-16 2003-06-05 Hitchen Stephen M. Collaborative file access management system
US20030115208A1 (en) 2001-12-14 2003-06-19 Nec Corporation Access right management system, access right management method and program therefor
US20030131057A1 (en) 2002-01-08 2003-07-10 International Business Machines Corporation Transmitting common and unique information selectively to different recipients
US6609200B2 (en) 1996-12-20 2003-08-19 Financial Services Technology Consortium Method and system for processing electronic documents
US20040006598A1 (en) 2002-03-01 2004-01-08 Tralix, L.L.C. Method and system of sending and tracking electronic mail messages
US20040013302A1 (en) 2001-12-04 2004-01-22 Yue Ma Document classification and labeling using layout graph matching
US20040024775A1 (en) 2002-06-25 2004-02-05 Bloomberg Lp Electronic management and distribution of legal information
US6775689B1 (en) 2000-06-07 2004-08-10 International Business Machines Corporation System for restructuring selected parts of email messages prior to transmission to plurality of recipients
US20050039034A1 (en) 2003-07-31 2005-02-17 International Business Machines Corporation Security containers for document components
US20050187937A1 (en) 2004-02-25 2005-08-25 Fuji Xerox Co., Ltd. Computer program product, device system, and method for providing document view
US6954532B1 (en) 2000-08-07 2005-10-11 Xerox Corporation Selective encryption of mixed raster content layers
US20050251508A1 (en) 2004-05-10 2005-11-10 Masaaki Shimizu Program and method for file access control in a storage system
US20060075228A1 (en) 2004-06-22 2006-04-06 Black Alistair D Method and apparatus for recognition and real time protection from view of sensitive terms in documents
US20060085469A1 (en) 2004-09-03 2006-04-20 Pfeiffer Paul D System and method for rules based content mining, analysis and implementation of consequences
US20060117010A1 (en) 2004-11-29 2006-06-01 Nokia Corporation Access rights
US20060224589A1 (en) 2005-02-14 2006-10-05 Rowney Kevin T Method and apparatus for handling messages containing pre-selected data
US20060271596A1 (en) 2005-05-26 2006-11-30 Sabsevitz Arthur L File access management system
US20070027873A1 (en) 2005-07-29 2007-02-01 International Business Machines Corporation Content-based file system security
US20070094594A1 (en) 2005-10-06 2007-04-26 Celcorp, Inc. Redaction system, method and computer program product
US20070116281A1 (en) 2005-11-23 2007-05-24 Brown Michael K E-mail with secure message parts
US20070136198A1 (en) 2005-12-14 2007-06-14 Pitney Bowes Incorporated Method of facilitating the tracing and/or auditing of operations performed during check image processing
US20070174285A1 (en) 2004-06-28 2007-07-26 Microsoft Corporation Systems and methods for fine grained access control of data stored in relational databases
US20070226174A1 (en) 2006-03-24 2007-09-27 Canon Kabushiki Kaisha Document management apparatus and document management method
US20070233687A1 (en) 2006-03-29 2007-10-04 Fuji Xerox Co., Ltd. File access control device, password setting device, process instruction device, and file access control method
US20080062472A1 (en) 2006-09-12 2008-03-13 Morgan Stanley Document handling
US7346769B2 (en) 2003-10-23 2008-03-18 International Business Machines Corporation Method for selective encryption within documents
US20080072032A1 (en) 2006-09-19 2008-03-20 Searete Llc, A Limited Liability Corporation Of The State Of Delaware Configuring software agent security remotely
US20080104118A1 (en) 2006-10-26 2008-05-01 Pulfer Charles E Document classification toolbar
US20080114725A1 (en) 2006-11-13 2008-05-15 Exegy Incorporated Method and System for High Performance Data Metatagging and Data Indexing Using Coprocessors
US7392289B2 (en) 2003-08-01 2008-06-24 Estationer, Llc Method, system, and program product for automatically formatting electronic mail addressed to an intended recipient
US20080168135A1 (en) 2007-01-05 2008-07-10 Redlich Ron M Information Infrastructure Management Tools with Extractor, Secure Storage, Content Analysis and Classification and Method Therefor
US20080229428A1 (en) 2005-03-07 2008-09-18 Noam Camiel System and Method For a Dynamic Policies Enforced File System For a Data Storage Device
US20080270807A1 (en) 2004-04-15 2008-10-30 Randolph Michael Forlenza Method for Selective Encryption Within Documents
US20080301760A1 (en) 2005-12-29 2008-12-04 Blue Jungle Enforcing Universal Access Control in an Information Management System
US20080300850A1 (en) 2007-05-31 2008-12-04 Jack Chen Method and apparatus for processing xml for display on a mobile device
US20080301482A1 (en) 2007-05-31 2008-12-04 Goff Lonnie C Method and apparatus for connecting multiple multimode processors
US7467399B2 (en) 2004-03-31 2008-12-16 International Business Machines Corporation Context-sensitive confidentiality within federated environments
US20090006851A1 (en) 2007-06-29 2009-01-01 Microsoft Corporation Confidential mail with tracking and authentication
US20090019379A1 (en) 2007-07-12 2009-01-15 Pendergast Brian S Document Redaction in a Web-Based Data Analysis and Document Review System
US20090030884A1 (en) 2007-06-08 2009-01-29 Pulfer Charles E Method and system for e-mail management of e-mail having embedded classification metadata
US20090106271A1 (en) 2007-10-19 2009-04-23 International Business Machines Corporation Secure search of private documents in an enterprise content management system
US20090254572A1 (en) 2007-01-05 2009-10-08 Redlich Ron M Digital information infrastructure and method
US20090296166A1 (en) 2008-05-16 2009-12-03 Schrichte Christopher K Point of scan/copy redaction
US20100030798A1 (en) 2007-01-23 2010-02-04 Clearwell Systems, Inc. Systems and Methods for Tagging Emails by Discussions
US20100153167A1 (en) 2008-12-16 2010-06-17 Sap Ag Incorporating workflow process modifications
US20100174751A1 (en) 2009-01-07 2010-07-08 Canon Kabushiki Kaisha Method and apparatus for manageing file
US20100185676A1 (en) 2009-01-13 2010-07-22 Weaver Richard H System and method for the centralized management of a document ordering and delivery program
US20100313239A1 (en) 2009-06-09 2010-12-09 International Business Machines Corporation Automated access control for rendered output
US20110035421A1 (en) 2009-08-05 2011-02-10 Microsoft Corporation Sharing files on a computer through use of uris
US7958147B1 (en) 2005-09-13 2011-06-07 James Luke Turner Method for providing customized and automated security assistance, a document marking regime, and central tracking and control for sensitive or classified documents in electronic format
US20110202618A1 (en) 2007-11-19 2011-08-18 International Business Machines Corporation Active Removal of E-Mail Recipient from Replies and Subsequent Threads
US8031865B2 (en) 2004-01-08 2011-10-04 Encryption Solutions, Inc. Multiple level security system and method for encrypting data within documents

Patent Citations (55)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6609200B2 (en) 1996-12-20 2003-08-19 Financial Services Technology Consortium Method and system for processing electronic documents
US20010010052A1 (en) 2000-01-25 2001-07-26 Satoshi Sakamoto Method for controlling multithreading
US6775689B1 (en) 2000-06-07 2004-08-10 International Business Machines Corporation System for restructuring selected parts of email messages prior to transmission to plurality of recipients
US6954532B1 (en) 2000-08-07 2005-10-11 Xerox Corporation Selective encryption of mixed raster content layers
US20030105734A1 (en) 2001-11-16 2003-06-05 Hitchen Stephen M. Collaborative file access management system
US20040013302A1 (en) 2001-12-04 2004-01-22 Yue Ma Document classification and labeling using layout graph matching
US20030115208A1 (en) 2001-12-14 2003-06-19 Nec Corporation Access right management system, access right management method and program therefor
US20030131057A1 (en) 2002-01-08 2003-07-10 International Business Machines Corporation Transmitting common and unique information selectively to different recipients
US20040006598A1 (en) 2002-03-01 2004-01-08 Tralix, L.L.C. Method and system of sending and tracking electronic mail messages
US20040024775A1 (en) 2002-06-25 2004-02-05 Bloomberg Lp Electronic management and distribution of legal information
US7685645B2 (en) 2003-07-31 2010-03-23 International Business Machines Corporation Security containers for document components
US20050039034A1 (en) 2003-07-31 2005-02-17 International Business Machines Corporation Security containers for document components
US7392289B2 (en) 2003-08-01 2008-06-24 Estationer, Llc Method, system, and program product for automatically formatting electronic mail addressed to an intended recipient
US7346769B2 (en) 2003-10-23 2008-03-18 International Business Machines Corporation Method for selective encryption within documents
US8140857B2 (en) 2003-10-23 2012-03-20 International Business Machines Corporation Method for selective encryption within documents
US8031865B2 (en) 2004-01-08 2011-10-04 Encryption Solutions, Inc. Multiple level security system and method for encrypting data within documents
US20050187937A1 (en) 2004-02-25 2005-08-25 Fuji Xerox Co., Ltd. Computer program product, device system, and method for providing document view
US7467399B2 (en) 2004-03-31 2008-12-16 International Business Machines Corporation Context-sensitive confidentiality within federated environments
US20080270807A1 (en) 2004-04-15 2008-10-30 Randolph Michael Forlenza Method for Selective Encryption Within Documents
US20050251508A1 (en) 2004-05-10 2005-11-10 Masaaki Shimizu Program and method for file access control in a storage system
US20060075228A1 (en) 2004-06-22 2006-04-06 Black Alistair D Method and apparatus for recognition and real time protection from view of sensitive terms in documents
US20070174285A1 (en) 2004-06-28 2007-07-26 Microsoft Corporation Systems and methods for fine grained access control of data stored in relational databases
US20060085469A1 (en) 2004-09-03 2006-04-20 Pfeiffer Paul D System and method for rules based content mining, analysis and implementation of consequences
US20060117010A1 (en) 2004-11-29 2006-06-01 Nokia Corporation Access rights
US20060224589A1 (en) 2005-02-14 2006-10-05 Rowney Kevin T Method and apparatus for handling messages containing pre-selected data
US20080229428A1 (en) 2005-03-07 2008-09-18 Noam Camiel System and Method For a Dynamic Policies Enforced File System For a Data Storage Device
US20060271596A1 (en) 2005-05-26 2006-11-30 Sabsevitz Arthur L File access management system
US20070027873A1 (en) 2005-07-29 2007-02-01 International Business Machines Corporation Content-based file system security
US7958147B1 (en) 2005-09-13 2011-06-07 James Luke Turner Method for providing customized and automated security assistance, a document marking regime, and central tracking and control for sensitive or classified documents in electronic format
US20070094594A1 (en) 2005-10-06 2007-04-26 Celcorp, Inc. Redaction system, method and computer program product
US20070116281A1 (en) 2005-11-23 2007-05-24 Brown Michael K E-mail with secure message parts
US20070136198A1 (en) 2005-12-14 2007-06-14 Pitney Bowes Incorporated Method of facilitating the tracing and/or auditing of operations performed during check image processing
US20080301760A1 (en) 2005-12-29 2008-12-04 Blue Jungle Enforcing Universal Access Control in an Information Management System
US20070226174A1 (en) 2006-03-24 2007-09-27 Canon Kabushiki Kaisha Document management apparatus and document management method
US20070233687A1 (en) 2006-03-29 2007-10-04 Fuji Xerox Co., Ltd. File access control device, password setting device, process instruction device, and file access control method
US20080062472A1 (en) 2006-09-12 2008-03-13 Morgan Stanley Document handling
US20080072032A1 (en) 2006-09-19 2008-03-20 Searete Llc, A Limited Liability Corporation Of The State Of Delaware Configuring software agent security remotely
US20080104118A1 (en) 2006-10-26 2008-05-01 Pulfer Charles E Document classification toolbar
US20080114725A1 (en) 2006-11-13 2008-05-15 Exegy Incorporated Method and System for High Performance Data Metatagging and Data Indexing Using Coprocessors
US20080168135A1 (en) 2007-01-05 2008-07-10 Redlich Ron M Information Infrastructure Management Tools with Extractor, Secure Storage, Content Analysis and Classification and Method Therefor
US20090254572A1 (en) 2007-01-05 2009-10-08 Redlich Ron M Digital information infrastructure and method
US20100030798A1 (en) 2007-01-23 2010-02-04 Clearwell Systems, Inc. Systems and Methods for Tagging Emails by Discussions
US20080300850A1 (en) 2007-05-31 2008-12-04 Jack Chen Method and apparatus for processing xml for display on a mobile device
US20080301482A1 (en) 2007-05-31 2008-12-04 Goff Lonnie C Method and apparatus for connecting multiple multimode processors
US20090030884A1 (en) 2007-06-08 2009-01-29 Pulfer Charles E Method and system for e-mail management of e-mail having embedded classification metadata
US20090006851A1 (en) 2007-06-29 2009-01-01 Microsoft Corporation Confidential mail with tracking and authentication
US20090019379A1 (en) 2007-07-12 2009-01-15 Pendergast Brian S Document Redaction in a Web-Based Data Analysis and Document Review System
US20090106271A1 (en) 2007-10-19 2009-04-23 International Business Machines Corporation Secure search of private documents in an enterprise content management system
US20110202618A1 (en) 2007-11-19 2011-08-18 International Business Machines Corporation Active Removal of E-Mail Recipient from Replies and Subsequent Threads
US20090296166A1 (en) 2008-05-16 2009-12-03 Schrichte Christopher K Point of scan/copy redaction
US20100153167A1 (en) 2008-12-16 2010-06-17 Sap Ag Incorporating workflow process modifications
US20100174751A1 (en) 2009-01-07 2010-07-08 Canon Kabushiki Kaisha Method and apparatus for manageing file
US20100185676A1 (en) 2009-01-13 2010-07-22 Weaver Richard H System and method for the centralized management of a document ordering and delivery program
US20100313239A1 (en) 2009-06-09 2010-12-09 International Business Machines Corporation Automated access control for rendered output
US20110035421A1 (en) 2009-08-05 2011-02-10 Microsoft Corporation Sharing files on a computer through use of uris

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8955040B2 (en) 2012-02-27 2015-02-10 Axiomatics Ab Provisioning authorization claims using attribute-based access-control policies
US9430662B2 (en) 2012-02-27 2016-08-30 Axiomatics Ab Provisioning authorization claims using attribute-based access-control policies
US20130332213A1 (en) * 2012-06-07 2013-12-12 Jayne Heggen Virtual Outsourcing Agency System and Method
US9973509B2 (en) 2014-09-05 2018-05-15 Axiomatics Ab Provisioning system-level permissions using attribute-based access control policies
US10404707B2 (en) 2014-09-05 2019-09-03 Axiomatics Ab Provisioning system-level permissions using attribute-based access control policies
US9754098B2 (en) 2014-10-26 2017-09-05 Microsoft Technology Licensing, Llc Providing policy tips for data loss prevention in collaborative environments
US10216919B2 (en) 2014-10-26 2019-02-26 Microsoft Technology Licensing, Llc Access blocking for data loss prevention in collaborative environments
US10007800B2 (en) 2015-02-19 2018-06-26 Axiomatics Ab Remote rule execution
US20180336033A1 (en) * 2015-12-17 2018-11-22 The Charles Stark Draper Laboratory, Inc. Metadata Processing
US10521230B2 (en) * 2015-12-17 2019-12-31 The Charles Stark Draper Laboratory, Inc. Data techniques
US10545760B2 (en) * 2018-06-07 2020-01-28 The Charles Stark Draper Laboratory, Inc. Metadata processing

Also Published As

Publication number Publication date
US20130097667A1 (en) 2013-04-18
US20100262577A1 (en) 2010-10-14
US8332350B2 (en) 2012-12-11

Similar Documents

Publication Publication Date Title
Strembeck et al. An integrated approach to engineer and enforce context constraints in RBAC environments
US7610285B1 (en) System and method for classifying objects
US7478094B2 (en) High run-time performance method for setting ACL rule for content management security
US10318620B2 (en) General purpose annotation service for portal-based applications
US7543232B2 (en) Intelligent web based help system
US6990480B1 (en) Information manager method and system
US7650512B2 (en) Method of and system for searching unstructured data stored in a database
Karjoth et al. Platform for enterprise privacy practices: Privacy-enabled management of customer data
Terrizzano et al. Data Wrangling: The Challenging Yourney from the Wild to the Lake.
JP4738708B2 (en) Evidence-based security policy manager
US7428582B2 (en) Semantic interface for publishing a web service to and discovering a web service from a web service registry
US7558799B2 (en) Method, system, and apparatus for discovering and connecting to data sources
US8752045B2 (en) Methods and apparatus for using tags to control and manage assets
EP1424618A1 (en) Method and computer system for protecting electronic documents
US20030097383A1 (en) Enterprise privacy system
JP2008547118A (en) Granting unified authority for heterogeneous applications
US9749368B2 (en) Social network media sharing with client library
US7865873B1 (en) Browser-based system and method for defining and manipulating expressions
US8880461B2 (en) Method and system for managing enterprise content
Ashley et al. E-P3P privacy policies and privacy authorization
US7805472B2 (en) Applying multiple disposition schedules to documents
Barkley et al. Supporting relationships in access control using role based access control
CN101583952B (en) Integrating enterprise search systems with custom access control application programming interfaces
US8234693B2 (en) Secure document management
US7966493B2 (en) Method of and system for determining if an electronic signature is necessary in order to commit a transaction to a database

Legal Events

Date Code Title Description
AS Assignment

Owner name: TITUS INC., CANADA

Free format text: CHANGE OF NAME;ASSIGNOR:TITUS LABS INC.;REEL/FRAME:029441/0543

Effective date: 20110106

Owner name: TITUS LABS INC., CANADA

Free format text: CHANGE OF ADDRESS OF COMPANY;ASSIGNOR:TITUS LABS INC.;REEL/FRAME:029441/0493

Effective date: 20110103

Owner name: TITUS LABS INC., CANADA

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:PULFER, CHARLES EDOUARD;WHITNEY, BENJAMIN TAYLOR;ROY, REGI BABY;SIGNING DATES FROM 20100324 TO 20100325;REEL/FRAME:029438/0239

STCF Information on status: patent grant

Free format text: PATENTED CASE

FPAY Fee payment

Year of fee payment: 4